chaospatterns

Yeah it’s useful and I’ve been using it for my home lab, but too many of my containers want outbound connections to the Internet. Like Forgejo needs :443 to be able to mirror or remote push repositories, so either I have to identify and allow list github.com, gitlab.com, etc. or end up allowing 0.0.0.0/0:443 which is not very strong protection.

I’d love for some kind of CNI or network plugin that filtered based on domain name.

Since you’re using Kubernetes, have you looked at external-dns? In my home lab, I use external-dns to take Ingress and Service resources and register them into my internal DNS zone. I use the etcd backend. external-dns registers zones in etcd, then CoreDNS queries from etcd. As soon as I create a new Ingress, it’s automatically registered and pointing to my Traefik service.

github.com/kubernetes-sigs/…/coredns-etcd.md

It’s a small model that runs on your machine using a TFLite model. AI/ML models come in many different sizes. Some more conducive for running locally than others. There’s more info on the detection pipeline here.

I didn’t write this, just found and self hosted it.

Its not difficult for technical people like you or me, but my friend who just wants to watch their favorite show on my Plex on their TV won’t know how to traffic engineer the traffic over a Tailscale network to my network.

With Plex, you’re getting the easy ability to grant access to users. You get a single pane that can search across multiple Plex instances, and NAT traversal/port forwarding. Jellyfin makes you figure that out yourself.